skill-creator
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/init_skill.pygenerates boilerplate Python and Markdown files by populating static templates with user-supplied variables like skill names and titles. - [PRIVILEGE_ESCALATION]: The initialization process automatically applies executable permissions (
0o755) to the newly created template scripts to support standard development workflows. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-defined parameters for skill creation, which are used to generate filesystem objects and populate templates.
- Ingestion points: User-provided skill name and directory path arguments in
scripts/init_skill.py. - Boundary markers: None are present to delimit the interpolated user data within the generated templates.
- Capability inventory: The skill performs directory creation, file writing, and permission modifications using the
pathlibandosmodules inscripts/init_skill.py. - Sanitization: The skill utilizes
scripts/quick_validate.pyto enforce hyphen-case naming conventions and prevent the use of angle brackets in metadata fields.
Audit Metadata